Threat actors run credential-phishing campaigns that spoof U.S. government departments (DoL, DoC, DoT) to lure victims into submitting credentials via multi-step, convincingly branded PDFs and pages. The campaigns have evolved since 2019, improving email content, PDF metadata, and the credential phishing flow to appear legitimate even against secure gateways.
Keypoints
- The phishing campaigns spoof U.S. government departments (Department of Labor, Department of Commerce, Department of Transportation) to target energy and professional services sectors.
- Sender addresses shifted from dol-gov.us to dot.gov appearances, and sending IPs were associated with Hivelocity Inc ASN; some servers identified themselves as Microsoft IIS.
- PDFs attached to emails have evolved from simple documents to customized, department-mapped files with authentic-looking metadata (e.g., WisDOT) and watermarks.
- The credential phishing page begins as a DoL/DoC/DoT-like homepage with an extra “bid” button, then redirects to a multi-page flow that collects credentials.
- The flow uses HTTPS, long subdomains with .gov cues, and link routes like /bidwindow.htm → /openbid.php → /completegen.html, culminating in a /bidwindowverify.htm captcha step.
- Victims are redirected back to the legitimate department site after credential submission, making detection harder; phishing training is emphasized as a defense.
- Cofense Intelligence will continue tracking campaigns and sharing IOCs and rules to help customers predict and block similar attacks.
MITRE Techniques
- [T1566.001] Spearphishing Attachment – PDFs attached to emails lure victims. Quote: “PDFs attached to these emails have changed over time.”
- [T1566.002] Spearphishing Link – Emails include links to access the PDFs rather than directly attaching them. Quote: “Recent emails also include links to access the PDFs rather than directly attaching them.”
Indicators of Compromise
- [Email Addresses] context – [email protected], [email protected]
- [Domains] context – dol-gov.us, transportation.gov.bidprocure.secure.akjackpot.com
- [URLs] context – https://transportation.gov.bidprocure.secure.akjackpot.com/bidwindow.htm, https://transportation.gov.bidprocure.secure.akjackpot.com/bidwindowverify.htm
- [Paths] context – /bidwindow.htm, /bidwindowverify.htm
Read more: https://cofense.com/blog/credential-phishing-targeting-government-contractors-evolves-over-time